NSE4 Practice Test 49 — 15 Questions

Question 1

An administrator is troubleshooting a FortiGate that is not sending logs to FortiAnalyzer. The FortiAnalyzer is reachable from the FortiGate. Which command should the administrator use to test the connectivity and log forwarding?

Accepted Answer

execute log fortianalyzer test. Option D is correct. 'execute log fortianalyzer test' sends a test log to FortiAnalyzer to verify connectivity and configuration.

Answer

execute log send

Answer

ping <FortiAnalyzer IP>

Answer

diagnose debug application fortianalyzer

Question 2

An administrator wants to view the current session table entries filtered by destination port 443. Which command should be used?

Accepted Answer

diagnose sys session filter dport 443; diagnose sys session list. The 'diagnose sys session filter' command sets filters, and 'diagnose sys session list' displays the filtered sessions.

Answer

execute session list dport 443

Answer

diagnose debug flow filter dport 443

Answer

diagnose sys session list dport 443

Question 3

A FortiGate administrator runs 'diagnose sys session filter dport 443' followed by 'diagnose sys session list' and sees the following output for a session:
src=10.0.1.10 dst=192.168.2.20 sport=12345 dport=443 proto=6
vrf=0

What does the 'proto=6' indicate about this session?

Accepted Answer

The session is using TCP. Option D is correct. Protocol number 6 is TCP. The session is a TCP session to port 443 (HTTPS).

Answer

The session is using UDP

Answer

The session is using ESP

Answer

The session is using ICMP

Question 4

A FortiGate administrator is troubleshooting an issue where internal users cannot access a public web server. The administrator runs 'diagnose debug flow' and sees the output shows 'forward to port2' but then 'no route to host'. What is the most likely cause?

Accepted Answer

The FortiGate does not have a route to the destination IP. Option A is correct. 'No route to host' indicates that the FortiGate does not have a route to the destination IP in the routing table. The packet is being forwarded to the correct interface (port2) but then cannot be routed further.

Answer

The source IP is not in the routing table

Answer

The interface port2 is down

Answer

The destination port is blocked by a firewall policy

Question 5

A FortiGate administrator notices that the HA cluster is frequently failing over even though no hardware failure has occurred. The heartbeat link shows some packet loss. What is the best action to reduce unnecessary failovers?

Accepted Answer

Increase the failover threshold. Option D is correct. Increasing the failover threshold (the number of missed heartbeats before triggering failover) makes the cluster more tolerant to temporary heartbeat loss, reducing false failovers.

Answer

Lower the heartbeat interval

Answer

Change HA mode to active-active

Answer

Disable session synchronization

Question 6

Which of the following FortiGate log types records information about user authentication and administrative access?

Accepted Answer

Event logs. Option A is correct. Event logs record system events such as user authentication, admin logins, and configuration changes.

Answer

Traffic logs

Answer

System logs

Answer

Security logs

Question 7

An administrator configures a FortiGate HA cluster in active-passive mode. After a failover, some UDP-based sessions are lost. What is the MOST likely reason?

Accepted Answer

UDP session synchronization is not enabled by default. UDP is stateless and not synchronized by default in active-passive HA unless session synchronization is configured. TCP sessions are synchronized by default.

Answer

The heartbeat interface failed

Answer

The failover triggered a routing table change

Answer

The HA priority was set too low on the backup unit

Question 8

An administrator wants to capture HTTP traffic on port1 for troubleshooting. Which CLI command should be used?

Accepted Answer

diagnose sniffer packet port1 'tcp port 80'. The 'diagnose sniffer packet' command is used to capture packets in FortiGate CLI.

Answer

diagnose debug flow

Answer

execute sniffer packet

Answer

diagnose sys session filter

Question 9

An administrator configures HA override on a cluster with priority 200 on primary and 100 on secondary. The primary fails, secondary takes over. When primary recovers, what happens?

Accepted Answer

Primary immediately takes over as active. With HA override enabled, the higher priority unit (primary) will preempt the secondary upon recovery, assuming it has higher priority.

Answer

Both units become active, causing a conflict

Answer

Secondary remains active until next failover

Answer

The administrator must manually trigger failback

Question 10

Which type of log records information about firewall policy matches, such as allowed or denied traffic?

Accepted Answer

Traffic logs. Traffic logs record information about sessions matching firewall policies.

Answer

Security logs

Answer

Event logs

Answer

Audit logs

Question 11

In an active-passive HA cluster, the administrator wants to ensure that new connections are load-balanced across both units only for specific services while maintaining failover capability. Which configuration should be applied?

Accepted Answer

Enable 'set load-balance-schedule' on the HA interface. Option B is correct. Load balancing in HA is achieved by enabling 'load-balance-schedule' on the HA interface. This allows distributing new sessions across cluster units while retaining active-passive failover behavior.

Answer

Set 'set ha-priority' to 100 on both units

Answer

Change HA mode to active-active

Answer

Configure virtual IPs for each service

Question 12

An administrator runs 'diagnose debug flow' and sees the output 'no matching policy'. What does this indicate?

Accepted Answer

There is no firewall policy that allows the traffic from the source to the destination. The debug flow trace shows packets flowing through the firewall policy evaluation. 'No matching policy' means the packet did not match any firewall policy.

Answer

The packet is being processed by a policy with the correct source/destination

Answer

The packet was dropped due to an antivirus signature match

Answer

The packet is being routed through a blackhole route

Question 13

In an active-active HA cluster, session synchronization is configured. A new session is created on the primary unit. When does the secondary unit learn about this session?

Accepted Answer

Within a few milliseconds to seconds after creation. In active-active HA with session sync, sessions are synchronized periodically (every few seconds) or immediately depending on configuration. By default, sessions are synced every 200ms or when the session changes state.

Answer

During the next heartbeat interval

Answer

After the session is closed

Answer

Immediately upon session creation

Question 14

An administrator notices that the FortiGate is not receiving updates from FortiGuard. The DNS settings are correct and the FortiGate can ping update.fortiguard.net. What is the MOST likely cause?

Accepted Answer

The FortiGuard subscription has expired. If DNS and connectivity are fine, the issue is often that the FortiGate's FortiGuard subscription has expired or the contract is not properly registered.

Answer

The firewall policy blocks outbound HTTPS

Answer

The antivirus profile is blocking the update traffic

Answer

The update server IP address changed

Question 15

An administrator needs to configure HA on a pair of FortiGates with the following requirements: the cluster must support session failover for TCP, UDP, and ICMP; the management interface should be accessible on both units; and the failover must be triggered if port2 goes down. Which TWO settings must be configured? (Choose two.)

Accepted Answer

Enable session pickup. To support TCP, UDP, and ICMP session failover, the session pickup feature must be enabled. To trigger failover on interface failure, the monitor interface must include port2.

Answer

Configure a dedicated management interface

Answer

Set the HA mode to active-passive

Answer

Set the HA override to enabled